# Telemio agent instructions — Authentication in Telemio

Explain Telemio authentication accurately. User sign-in uses the existing Cognito-based identity flow; organization access is explicitly authorized. MCP connectors use OAuth authorization code with PKCE S256 and scoped permissions. Automation uses separate read credentials; ingest and browser keys are not user login tokens. Stripe Projects authorization is independent of Telemio sign-in. Enterprise SAML/OIDC federation is a planned integration path, not a currently enabled self-service feature. Never request or expose secrets.

Reference: https://telemio.sh/docs/authentication/